EUVD-2026-54609Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted packet with malformed length/offset field
-
DeliveryApplication feeds packet bytes to DecodingLayerParser or DecodeFromBytes
-
ExploitVulnerable decoder reads attacker-controlled value without buffer bounds check
-
ExecutionOut-of-bounds slice operation triggers unrecovered Go runtime panic
-
ImpactApplication goroutine or process terminates
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must use gopacket's DecodingLayerParser or invoke DecodeFromBytes directly on one of the eleven affected decoders (TLS, DHCPv4, Diameter, SFlow, IPSec AH, VRRPv2, GTPv1U, ERSPANII, LCM, RadioTap, Dot11InformationElement) with data originating from an untrusted source. Applications that use gopacket.NewPacket with default options are partially protected because that code path internally recovers panics - the DecodingLayerParser path explicitly does not recover panics, as stated in the upstream advisory and confirmed by the regression test comments. Exploitation requires no authentication (CVSS PR:N) and no prior session state; the limiting factor is whether the application exposes a network interface or input channel that passes attacker-controlled bytes to the vulnerable decoder API. |
| Impact | The NVD CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes an unauthenticated, low-complexity, network-accessible DoS. No EPSS score was supplied in the intelligence data. The vulnerability is not in CISA KEV, and no standalone public exploit code is referenced; the patch commit does include regression test cases that demonstrate exact crash inputs (e.g., DHCPv4 with HardwareLen=0xFF, Diameter with MessageLength below 20), which lower the bar for exploit construction but are not weaponized PoC. A discrepancy exists in the source intelligence: the 'Information Disclosure' tag conflicts with the description, the CWE-125 context, and the commit diff - no data-exfiltration path is evident, and the impact appears limited to availability. The real-world risk is bounded but genuine: any Go network tool processing untrusted traffic through DecodingLayerParser is fully exposed, while applications using gopacket.NewPacket with default error recovery options have partial built-in protection. |
| Exploit ScenarioDerived | An attacker sends a single crafted UDP or Ethernet frame - for example, a DHCPv4 message with the hardware address length byte set to 0xFF, or a Diameter message with MessageLength set to 4 - to any service built on gopacket ≤ 1.7.0 that feeds untrusted traffic into DecodingLayerParser. The relevant decoder reads the attacker-supplied length field and forms a slice expression that references memory beyond the buffer, triggering an unrecovered Go runtime panic that crashes the parsing goroutine or the entire process. No authentication, established session, or user interaction is required; the regression test cases in the patch commit confirm that a handful of bytes is sufficient to reproduce each crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 07, 2026
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
RemediationAI
The upstream fix is available at commit 210f25fb9b3ca1af2eb649936f78ad6991b6c9c5 (https://github.com/gopacket/gopacket/commit/210f25fb9b3ca1af2eb649936f78ad6991b6c9c5); however, a tagged release incorporating this fix has not been independently confirmed from the available references - v1.7.0 remains the most recent known tag and is still vulnerable. Consumers should pin their Go module to the fix commit using a replace directive or monitor the releases page at https://github.com/gopacket/gopacket/releases for a patched tagged release. As a compensating control, wrap DecodingLayerParser decode calls in a recover() defer to prevent panics from crashing the process - note this adds per-packet overhead and may silently swallow legitimate parsing errors that callers should handle. Alternatively, switch from DecodingLayerParser to gopacket.NewPacket with default options, which internally recovers panics; this trades some decode throughput for resilience. Applications that can allowlist or sanitize input packets before passing them to gopacket should do so at the network boundary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
gopacket is a Go library providing packet capture and protocol layer decoding, analogous to combining libpcap bindings with a layered parser framework. CWE-125 (Out-of-bounds Read) is the root cause: fields such as HardwareLen in DHCPv4, MessageLength in Diameter, ActualLength in IPSec AH, extension header indices in GTPv1U and RadioTap, and count fields in VRRPv2 are read directly from raw packet bytes and then used as slice indices or lengths without first confirming the buffer is large enough. In Go, an out-of-bounds slice operation raises a runtime panic that propagates unless explicitly recovered. Critically, the DecodingLayerParser path - unlike gopacket.NewPacket with default options - does not install a recover() handler, so the panic is unrecovered and terminates the caller. The commit diff confirms twelve distinct decoder sites were patched by adding minimum-length guards before unsafe slice operations. CPE cpe:2.3:a:gopacket:gopacket:*:*:*:*:*:*:*:* covers all versions through v1.7.0.
Know when Gopacket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-delivered crafted packets require no privileges or interaction; impact is crash-only with no confidentiality or integrity effect confirmed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.
Executive ViewAI
gopacket, a widely-used Go packet processing library, contains a remote denial-of-service vulnerability (CVE-2026-65819) that can crash any Go application processing untrusted network packets. Organizations operating Go-based network monitoring, packet capture, and security tools face unplanned service disruptions and loss of security visibility from malformed network traffic. No vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict packet sources to trusted networks via firewall rules; (2) implement application-level header validation before DecodeFromBytes calls; (3) deploy packet parsing in isolated goroutines with automatic restart on panic; (4) enable resource monitoring and alerting for unexpected application crashes; (5) rate-limit packet ingestion at the network edge.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB